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Abstract 

In the first quarter of 2011, Android has become the top-selling op- 
erating system for smartphones. In this paper, we present a novel, 
highly critical attack that allows unprompted installation of arbitrary 
applications from the Android Market. Our attack is based on a single 
malicious application, which, in contrast to previously known attacks, 
does not require the user to grant it any permissions. 
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